MODIFIED docs/identity/authentication/how-to-mfa-registration-campaign.md

Modified by Justinha on Dec 12, 2025 3:00 PM
📖 View on learn.microsoft.com

+4 / -5 lines changed

Commit: Update MFA registration campaign prerequisites

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 06/19/2025
ms.author: justinha
author: mjsantani
manager: dougeby
 
## Prerequisites 
 
- Your organization must have enabled Microsoft Entra multifactor authentication. Every edition of Microsoft Entra ID includes Microsoft Entra multifactor authentication. No other license is needed for a registration campaign.
- Users can't have already set up the Authenticator app for push notifications on their account. 
- Admins need to enable users for the Authenticator app using one of these policies:  
  - MFA Registration Policy: Users will need to be enabled for **Notification through mobile app**. See [Configure the MFA registration policy](/entra/id-protection/howto-identity-protection-configure-mfa-policy).
  - Authentication Methods Policy: Users will need to be enabled for the Authenticator app and the Authentication mode set to **Any** or **Push**. If the policy is set to **Passwordless**, the user won't be eligible for the nudge. For more information about how to set the Authentication mode, see [Enable passwordless sign-in with Microsoft Authenticator](howto-authentication-passwordless-phone.md). 
 
## User experience
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 12/12/2025
ms.author: justinha
author: mjsantani
manager: dougeby
 
## Prerequisites 
 
- If you want to know the number of users who registered each authentication method, see [the Authentication methods activity report](howto-authentication-methods-.md#registration-details) before you configure the registration campaign.
- Your organization must enable Microsoft Entra multifactor authentication. All Microsoft Entra licence types support the registration campaign.
- Users can't have already set up the Authenticator app for push notifications on their account. 
- Admins need to enable users for the Authenticator app in the Authentication methods policy. The **Authentication mode** must be set to **Any** or **Push**. If the **Authentication mode** is set to **Passwordless**, users aren't eligible for the nudge. For more information about how to set the **Authentication mode**, see [Enable passwordless sign-in with Microsoft Authenticator](howto-authentication-passwordless-phone.md). 
 
## User experience
 
 

MODIFIED docs/identity/enterprise-apps/deactivate-application-portal.md

Modified by Chris Werner on Dec 12, 2025 9:06 AM
📖 View on learn.microsoft.com

+0 / -5 lines changed

Commit: remove service principal query

Changes:

Before

After

    GET https://graph.microsoft.com/beta/applications/{application-id}?$select=displayName,isDisabled,appId
    ```
 
1. Get specific service principal status
 
    ```http
    GET https://graph.microsoft.com/beta/servicePrincipals?$filter=accountEnabled eq false or isDisabled eq true or disabledByMicrosoftStatus eq DisabledDueToViolationOfServicesAgreement
 
## Investigate deactivated applications
 
When handling deactivated applications, conduct a thorough investigation by examining the application's configuration, including API permissions, authentication settings, certificates, and sign-in logs. Document your findings carefully, noting the reason for deactivation, any suspicious activity or security concerns, affected users, and dependencies that might impact your organization.

    GET https://graph.microsoft.com/beta/applications/{application-id}?$select=displayName,isDisabled,appId
    ```
 
## Investigate deactivated applications
 
When handling deactivated applications, conduct a thorough investigation by examining the application's configuration, including API permissions, authentication settings, certificates, and sign-in logs. Document your findings carefully, noting the reason for deactivation, any suspicious activity or security concerns, affected users, and dependencies that might impact your organization.

MODIFIED docs/identity/authentication/concept-authentication-methods-manage.md

Modified by Dr Bill Mcilhargey on Dec 12, 2025 3:36 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update link in authentication methods management documentation for consistency

Changes:

Before

After

---
# Manage authentication methods for Microsoft Entra ID
 
Microsoft Entra ID allows the use of a range of authentication methods to support a wide variety of sign-in scenarios. For an overview of the available options, see [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/authentication/overview-authentication). Administrators can specifically configure each method to meet their goals for user experience and security. This topic explains how to manage authentication methods for Microsoft Entra ID, and how configuration options affect user sign-in and password reset scenarios. 
 
## Authentication methods policy

---
# Manage authentication methods for Microsoft Entra ID
 
Microsoft Entra ID allows the use of a range of authentication methods to support a wide variety of sign-in scenarios. For an overview of the available options, see [Authentication methods in Microsoft Entra ID](overview-authentication.md). Administrators can specifically configure each method to meet their goals for user experience and security. This topic explains how to manage authentication methods for Microsoft Entra ID, and how configuration options affect user sign-in and password reset scenarios. 
 
## Authentication methods policy

MODIFIED docs/identity/authentication/concept-sspr-howitworks.md

Modified by Dr Bill Mcilhargey on Dec 12, 2025 2:49 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update authentication methods documentation to include link for overview and clarify Email OTP method in SSPR Article

Changes:

Before

After

* [Software OATH tokens](concept-authentication-oath-tokens.md#software-oath-tokens)
* [Short Message Service (SMS) sign-in](howto-authentication-sms-signin.md)
* [Voice call](concept-authentication-phone-options.md)
* [Email OTP](concept-sspr-howitworks.md#authentication-methods)
 
Users can only reset their password if they register an authentication method that the administrator has enabled.
 

* [Software OATH tokens](concept-authentication-oath-tokens.md#software-oath-tokens)
* [Short Message Service (SMS) sign-in](howto-authentication-sms-signin.md)
* [Voice call](concept-authentication-phone-options.md)
* Email OTP
 
Users can only reset their password if they register an authentication method that the administrator has enabled.
 

MODIFIED docs/identity/enterprise-apps/disable-user-sign-in-portal.md

Modified by Carolyn McSharry on Dec 12, 2025 10:40 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update disable-user-sign-in-portal.md

Changes:

Before

After

In this article, you learn how to prevent users from signing in to an application in Microsoft Entra ID through both the Microsoft Entra admin center and PowerShell. If you're looking for how to block specific users from accessing an application, use [user or group assignment](./assign-user-or-group-access-portal.md).
 
> [!NOTE]
> The steps in this article disable user sign-in for a single tenant. If you need to globally disable an application across all tenants (for multi-tenant apps), consider [deactivating the application](deactivate-application-portal.md) instead, which prevents all token issuance globally.
 
## Prerequisites

In this article, you learn how to prevent users from signing in to an application in Microsoft Entra ID through both the Microsoft Entra admin center and PowerShell. If you're looking for how to block specific users from accessing an application, use [user or group assignment](./assign-user-or-group-access-portal.md).
 
> [!NOTE]
> The steps in this article disable user sign-in for a single tenant. If you need to globally disable an application across all tenants (for multitenant apps), consider [deactivating the application](deactivate-application-portal.md) instead, which prevents all token issuance globally.
 
## Prerequisites

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files